999 matches found
Important: Red Hat Security Advisory: python-jwt security update
An update for python-jwt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...
ROOT-APP-PYPI-GHSA-PXH4-856F-4H89 GHSA-pxh4-856f-4h89 in PyJWT - Patched by Root
Root has patched GHSA-pxh4-856f-4h89 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_94500)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694500 advisory. pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102266 pyjwt: PyJWT: Authentication bypass via improper public key validation...
Rocky Linux 10.2 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_94501)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202694501 advisory. pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102266 pyjwt: PyJWT: Authentication bypass via improper public key validatio...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:5064-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5064-1 advisory. - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. ...
fence-agents security update
An update is available for fence-agents. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...
RLSA-2026:94501 Critical: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...
RLSA-2026:94500 Critical: fence-agents security update
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...
fence-agents security update
An update is available for fence-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...
Security update for python-PyJWT
This update for python-PyJWT fixes the following issues: CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens bsc1283065. CVE-2026-102270: an attacker can cause intensive CPU consumption bsc1283067. Patch Instructions: To install this SUSE update use the SUSE...
SUSE-SU-2026:5093-1 Security update for python-PyJWT
This update for python-PyJWT fixes the following issues: - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens bsc1283065. - CVE-2026-102270: an attacker can cause intensive CPU consumption bsc1283067...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance
A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...
Critical: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...